CVE-2026-53212 (GCVE-0-2026-53212)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34
VLAI
Title
netfilter: nft_tunnel: fix use-after-free on object destroy
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst_release() operates on freed memory. Replace metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped. The dst subsystem already handles metadata_dst cleanup in dst_destroy() when DST_METADATA is set.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: af308b94a2a4a5a27bec9028354c4df444a7c8ba , < 349df61526d2e39decc685d246202e3e284cfe05 (git)
Affected: af308b94a2a4a5a27bec9028354c4df444a7c8ba , < 55b79b1ae42372012413ce0413181d26679b17ef (git)
Affected: af308b94a2a4a5a27bec9028354c4df444a7c8ba , < 5e9ee18b27fde88cb6148202b33916c66693fe82 (git)
Affected: af308b94a2a4a5a27bec9028354c4df444a7c8ba , < 8767fe4079affa74314d7eb3220e700150289842 (git)
Affected: af308b94a2a4a5a27bec9028354c4df444a7c8ba , < fda6573a46ad24f35348e024905ee5bdf729797e (git)
Affected: af308b94a2a4a5a27bec9028354c4df444a7c8ba , < 941d7394efda5e054e2d6f3e0dd0f6a9ba19aaa3 (git)
Affected: af308b94a2a4a5a27bec9028354c4df444a7c8ba , < f9a0e4b61054cde89a2a77845293c726cc07cc43 (git)
Affected: af308b94a2a4a5a27bec9028354c4df444a7c8ba , < c32b26aaa2f9216520a38b3f4bfeec846eb3eb8a (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.94 , ≤ 6.12.* (semver)
Unaffected: 6.18.36 , ≤ 6.18.* (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "349df61526d2e39decc685d246202e3e284cfe05",
              "status": "affected",
              "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
              "versionType": "git"
            },
            {
              "lessThan": "55b79b1ae42372012413ce0413181d26679b17ef",
              "status": "affected",
              "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
              "versionType": "git"
            },
            {
              "lessThan": "5e9ee18b27fde88cb6148202b33916c66693fe82",
              "status": "affected",
              "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
              "versionType": "git"
            },
            {
              "lessThan": "8767fe4079affa74314d7eb3220e700150289842",
              "status": "affected",
              "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
              "versionType": "git"
            },
            {
              "lessThan": "fda6573a46ad24f35348e024905ee5bdf729797e",
              "status": "affected",
              "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
              "versionType": "git"
            },
            {
              "lessThan": "941d7394efda5e054e2d6f3e0dd0f6a9ba19aaa3",
              "status": "affected",
              "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
              "versionType": "git"
            },
            {
              "lessThan": "f9a0e4b61054cde89a2a77845293c726cc07cc43",
              "status": "affected",
              "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
              "versionType": "git"
            },
            {
              "lessThan": "c32b26aaa2f9216520a38b3f4bfeec846eb3eb8a",
              "status": "affected",
              "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_tunnel: fix use-after-free on object destroy\n\nnft_tunnel_obj_destroy() calls metadata_dst_free() which directly\nkfree()s the metadata_dst, ignoring the dst_entry refcount. Packets\nthat took a reference via dst_hold() in nft_tunnel_obj_eval() and\nare still queued (e.g. in a netem qdisc) are left with a dangling\npointer. When these packets are eventually dequeued, dst_release()\noperates on freed memory.\n\nReplace metadata_dst_free() with dst_release() so the metadata_dst\nis freed only after all references are dropped. The dst subsystem\nalready handles metadata_dst cleanup in dst_destroy() when\nDST_METADATA is set."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable nft_tunnel object is created, referenced, and destroyed through nf_tables netlink operations and packet processing configured locally via nftables/netdev hooks. Remote packets may help populate a queue, but exploitation requires local control of nftables transactions.\nAC:L - The attacker can set up the tunnel object/rule, arrange queued packets such as with netem, and delete the rule/object sequence under their control. No uncontrollable race or rare external condition is required.\nPR:L - nfnetlink requires CAP_NET_ADMIN in the socket network namespace, and nftables/netfilter is reachable by an unprivileged local user through user and network namespaces on typical affected systems. This is low privilege rather than real init-namespace root.\nUI:N - No victim user action is required after the attacker has local execution. The trigger is performed through attacker-issued netlink configuration and packet generation/dequeue.\nS:U - The bug corrupts kernel networking memory and can lead to local kernel privilege escalation within the same security authority. It is not a VM escape, IOMMU bypass, or other CVSS scope-changing boundary crossing.\nC:H - This is a heap use-after-free of a metadata_dst referenced from queued skbs, and similar nf_tables UAFs are exploitable for kernel memory disclosure. Following the higher-severity rule for UAFs, confidentiality impact is high.\nI:H - The freed dst/metadata object can be reclaimed and later operated on through dst_release and related networking paths, giving a plausible route to memory corruption and control-flow or arbitrary write exploitation. Following the kernel UAF guidance, integrity impact is high.\nA:H - Even without full exploitation, dequeuing packets with a dangling dst pointer can cause a kernel oops, panic, or memory-corruption crash. Availability impact is therefore high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:10.386Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/349df61526d2e39decc685d246202e3e284cfe05"
        },
        {
          "url": "https://git.kernel.org/stable/c/55b79b1ae42372012413ce0413181d26679b17ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e9ee18b27fde88cb6148202b33916c66693fe82"
        },
        {
          "url": "https://git.kernel.org/stable/c/8767fe4079affa74314d7eb3220e700150289842"
        },
        {
          "url": "https://git.kernel.org/stable/c/fda6573a46ad24f35348e024905ee5bdf729797e"
        },
        {
          "url": "https://git.kernel.org/stable/c/941d7394efda5e054e2d6f3e0dd0f6a9ba19aaa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9a0e4b61054cde89a2a77845293c726cc07cc43"
        },
        {
          "url": "https://git.kernel.org/stable/c/c32b26aaa2f9216520a38b3f4bfeec846eb3eb8a"
        }
      ],
      "title": "netfilter: nft_tunnel: fix use-after-free on object destroy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53212",
    "datePublished": "2026-06-25T08:39:16.888Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-08-05T12:34:10.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53212",
      "date": "2026-09-21",
      "epss": "0.00151",
      "percentile": "0.04612"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T14:47:14.000Z",
      "cve": "CVE-2026-53212",
      "id": "msrc_CVE-2026-53212",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nft_tunnel: fix use-after-free on object destroy",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53212.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nft_tunnel.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "349df61526d2e39decc685d246202e3e284cfe05",
                    "status": "affected",
                    "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "55b79b1ae42372012413ce0413181d26679b17ef",
                    "status": "affected",
                    "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5e9ee18b27fde88cb6148202b33916c66693fe82",
                    "status": "affected",
                    "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8767fe4079affa74314d7eb3220e700150289842",
                    "status": "affected",
                    "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fda6573a46ad24f35348e024905ee5bdf729797e",
                    "status": "affected",
                    "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "941d7394efda5e054e2d6f3e0dd0f6a9ba19aaa3",
                    "status": "affected",
                    "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f9a0e4b61054cde89a2a77845293c726cc07cc43",
                    "status": "affected",
                    "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c32b26aaa2f9216520a38b3f4bfeec846eb3eb8a",
                    "status": "affected",
                    "version": "af308b94a2a4a5a27bec9028354c4df444a7c8ba",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nft_tunnel.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.19"
                  },
                  {
                    "lessThan": "4.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.94",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.36",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "371269AD-0F41-4AA3-A04C-8560F4185F8B",
                    "versionEndExcluding": "5.10.259",
                    "versionStartIncluding": "4.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
                    "versionEndExcluding": "5.15.210",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
                    "versionEndExcluding": "6.1.176",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
                    "versionEndExcluding": "6.6.143",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9",
                    "versionEndExcluding": "6.12.94",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3",
                    "versionEndExcluding": "6.18.36",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E",
                    "versionEndExcluding": "7.0.13",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_tunnel: fix use-after-free on object destroy\n\nnft_tunnel_obj_destroy() calls metadata_dst_free() which directly\nkfree()s the metadata_dst, ignoring the dst_entry refcount. Packets\nthat took a reference via dst_hold() in nft_tunnel_obj_eval() and\nare still queued (e.g. in a netem qdisc) are left with a dangling\npointer. When these packets are eventually dequeued, dst_release()\noperates on freed memory.\n\nReplace metadata_dst_free() with dst_release() so the metadata_dst\nis freed only after all references are dropped. The dst subsystem\nalready handles metadata_dst cleanup in dst_destroy() when\nDST_METADATA is set."
          }
        ],
        "id": "CVE-2026-53212",
        "lastModified": "2026-07-02T20:53:00.457",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-06-25T09:16:38.793",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/349df61526d2e39decc685d246202e3e284cfe05"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/55b79b1ae42372012413ce0413181d26679b17ef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5e9ee18b27fde88cb6148202b33916c66693fe82"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8767fe4079affa74314d7eb3220e700150289842"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/941d7394efda5e054e2d6f3e0dd0f6a9ba19aaa3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c32b26aaa2f9216520a38b3f4bfeec846eb3eb8a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f9a0e4b61054cde89a2a77845293c726cc07cc43"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fda6573a46ad24f35348e024905ee5bdf729797e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:32:13+00:00",
      "cve": "CVE-2026-53212",
      "id": "CVE-2026-53212",
      "initial_release_date": "2026-06-25T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nft_tunnel: fix use-after-free on object destroy",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53212.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T16:57:13Z",
      "cve": "CVE-2026-53212",
      "id": "CVE-2026-53212",
      "initial_release_date": "2026-06-26T02:09:53Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "607",
      "product_status:known_not_affected": "125",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53212",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53212.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.